PECB ISO 28000 Lead Auditor key terms

A structured framework of policies, objectives, processes and resources by which an organisation directs and controls the security risks affecting its supply chain and operations, built on the ISO 28000 plan-do-check-act model.

The set of measures applied across the flow of goods, information and people from origin to destination to prevent theft, contamination, unauthorised access, smuggling and other deliberate harm.

A cyclical improvement model in which requirements are planned, implemented, monitored and reviewed, then adjusted, so that the management system keeps adapting to changing security threats.

A systematic process of identifying threats and vulnerabilities, estimating the likelihood and consequence of loss, and determining which risks need treatment within the security management system.

The selection and application of controls, such as avoidance, reduction, transfer or acceptance, to bring identified security risks within the organisation's defined risk criteria.

The level of security risk that remains after controls have been implemented, which must be compared with acceptance criteria and communicated to top management.

Predefined thresholds and conditions stating which levels of security risk the organisation is willing to tolerate without further treatment, providing a consistent basis for decisions.

A maintained record listing identified security risks, their owners, assessed likelihood and impact, chosen treatments and current status, used to track and review risk decisions.

Any facility, cargo, information system, vehicle or person whose loss, damage or compromise would significantly disrupt operations or undermine supply chain security objectives.

A potential source of harm to assets or operations, such as theft, intrusion, tampering, terrorism, fraud or cyber attack, whose likelihood and motivation are assessed during risk assessment.

A weakness in physical protection, procedures, personnel or information systems that a threat could exploit, increasing the likelihood or severity of a security incident.

A measure, whether physical, procedural, technological or organisational, implemented to prevent, detect, deter or respond to security events and reduce assessed risk.

A top-management statement of commitment that sets the organisation's security objectives, principles and framework, and provides the authority for establishing the security management system.

Measurable, time-bound goals that the organisation sets to reduce security risk or improve controls, which must be consistent with the security policy and monitored for progress.

A person or organisation, such as a customer, regulator, insurer, employee, contractor or neighbouring community, that can affect or be affected by the organisation's security performance.

Laws, regulations, international conventions, customer contracts and voluntary codes that apply to the organisation's security obligations and must be identified, accessed and complied with.

The combination of education, training, skills and experience required for personnel whose work affects security performance, verified so they can perform assigned roles effectively.

Information the organisation must control and maintain, including the security policy, risk assessments, procedures and records, covering both documents and the evidence they generate.

The processes ensuring information is available where needed, protected from loss or misuse, and properly versioned, approved, distributed and disposed of according to defined rules.

Planned arrangements, criteria and procedures applied to activities that create security risk, so that processes are carried out under specified conditions and deviations are managed.

Plans, resources and exercises that prepare the organisation to detect, react to and recover from security incidents, and to test and revise those arrangements periodically.

An event or situation that has caused or could cause loss, harm or disruption to assets, people or supply chain operations, requiring reporting, investigation and corrective action.

A failure to fulfil a requirement of the standard, the organisation's own security management system criteria, or applicable obligations, identified through audit or other monitoring.

Action taken to eliminate the cause of a detected nonconformity or incident so that it does not recur, including root cause analysis, implementation and verification of effectiveness.

The recurring process of enhancing security performance by identifying opportunities, implementing changes and measuring results, supported by monitoring, audit and management review.

The collection and analysis of data, such as incident rates, audit results and control effectiveness, to determine whether the security management system achieves its intended outcomes.

A top-management evaluation of the security management system's suitability, adequacy and effectiveness, using defined inputs and producing decisions on improvement and resource needs.

A systematic, independent and documented process for obtaining objective evidence and evaluating it against audit criteria to determine the extent of conformity.

The set of policies, procedures, requirements or standards against which audit evidence is compared, agreed with the client and communicated to the auditee before the audit.

Records, statements of fact or other verifiable information relevant to the audit criteria, which the auditor collects and evaluates to reach audit findings and conclusions.

The result of evaluating collected evidence against audit criteria, recorded as conformity or nonconformity and graded by significance, such as major, minor or observation.

The auditor's professional judgement on the overall conformity and effectiveness of the audited management system, based on the findings and stated in the audit report.

A set of one or more audits planned for a specific timeframe and purpose, directed at achieving efficient and effective coverage of the organisation's security management system.

A description of the activities and arrangements for a single audit, including objectives, criteria, scope, schedule, team roles and allocation of resources.

The extent and boundaries of an audit, specifying the organisational units, sites, processes and time period covered, agreed with the client and stated in the audit plan.

The demonstrated personal attributes, knowledge of ISO 28000 and audit principles, and skills needed to plan and conduct audits and report findings reliably.

One or more auditors, supported by technical experts or observers as needed, selected for the competence required by the audit scope and led by an audit team leader.

A formal meeting at the start of an on-site audit confirming objectives, scope, criteria, schedule, communication channels and rules of conduct with the auditee's management.

A meeting at the end of an audit at which the audit team presents findings and conclusions, explains their basis and agrees follow-up actions and reporting arrangements.

The selection of a portion of available information or records for examination, used when full checking is impractical, with the aim of drawing valid conclusions about the whole.

The documented output of an audit that records objectives, scope, criteria, findings, conclusions and any agreed follow-up, issued to the client within the agreed timeframe.

A verification activity confirming that corrective actions for reported nonconformities have been implemented and are effective, often scheduled after the original audit closes.

An approach in which audit effort is concentrated on the processes and sites with the highest security risk or weakest controls, improving the value obtained from limited audit resources.